CVE-2026-63754 - SurrealDB before 3.1.0 Denial of Service via LIVE Query

Back Back to CVE browser

HIGH

SurrealDB before 3.1.0 Denial of Service via LIVE Query

Published Jul 20, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.45%

Description

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write operations on a table for any user, including root, by registering a LIVE query that triggers evaluation errors until the query is killed or the session ends.

Affected products

Vendor Surrealdb Product Surrealdb Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.1.0
- Version
  3.1.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Surrealdb

unaffected

Version	Status	Constraints
0	affected	<3.1.0
3.1.0	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-754

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45925
Advisory
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4v76-cw68-4vc9
vendor-advisoryVendor AdvisoryPatch
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-live-query
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45925		Advisory
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4v76-cw68-4vc9		vendor-advisoryVendor AdvisoryPatch
https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-live-query		third-party-advisoryThird Party Advisory